"Login with Google" has a single point of failure- what am I missing?

As far as I can see, somebody can "login with Google" to any site that has that option available while they are currently logged into a connected Google account on the device they are using.

If that "somebody" was a malicious agent and not the owner of the device, they would be able to log into the owner's accounts across various sites as long as the owner was logged into their connected Google account, correct?

Most people stay logged into …

account agent can connected device failure far google google account login login with malicious missing point privacy single